Breachsignal NPM

Overview

Breachsignal is used for monitoring and analyzing user behaviour, enabling detection and prevention of security issues and account fraud. By monitoring every user, Breachsignal’s large-scale machine learning detects and reports application usage anomalies providing full anomaly context.

User transaction (request/response) information needs to be sent to Breachsignal for anomaly detection. This can be done using this library as well as via transactions API.

Detected anomalies can be analyzed in the dashboard or accessed using this library or via signals API.

Learn more at breachsignal.com/product.

Installation

Make sure you have a Breachsignal account before continuing. You can signup at breachsignal.com.

npm install breachsignal --save

Usage

Tracking user transactions automatically:

var breachsignal = require('breachsignal');

breachsignal.init({
  apiKey: 'API_KEY',
  appName: 'MyApp'
});

// should be called before the server starts listening
breachsignal.trackHttpRequests();

If user ID cannot be found in req.user or req.session.user objects under user_id, id or _id properties, use identifyUser method to associate user ID with request object on each request.

breachsignal.identifyUser(req, 'USER_ID');

Tracking user transactions programmatically:

var breachsignal = require('breachsignal')

breachsignal.init({
  apiKey: 'API_KEY',
  appName: 'MyApp'
});

...

breachsignal.track({
  client_ip: '203.0.113.1', // required
  user_id: '12345', // required
  url: '/user/login', // required
  method: 'PUT',
  request_size: 100,
  response_size: 0,
  status_code: 200
});

Receiving detected anomaly signals:

breachsignal.on("signal", function(signal) {
  // use signal.user_id, signal.client_ip and signal.score
});

Troubleshooting

For troubleshooting add debug:true flag to initialization options. A debug log will be written to STDIN and STDERR. If it doesn’t give you any hints on how to correct the problem, report the problem to Breachsignal Support from your account with the attached debug log.

Full documentation is available at breachsignal.com/docs.